Optional @lorepack/semantic-local package with bounded download contract

[burakdede]

Parent epic: #8 (post-v0.1 backlog)

Context

§5.6 and §8.9 define an optional local semantic package kept entirely outside the core dependency graph, enabled explicitly by lore enhance semantic. §4.3 forbids any model download on the first-run critical path, and §1.3 makes semantic retrieval a post-v0.1 enhancement "unless lifecycle validation shows it is required earlier".

This issue must not start before v0.1 ships. It exists so the contract is recorded, not so it is built early.

Spec references

§5.6 Future semantic adapter envelope, §8.9 Optional semantic package, §1.3 MVP decisions, §13.8 semantic fusion.

Scope

In: @lorepack/semantic-local package skeleton, the lore enhance semantic download/verification flow, and the SemanticIndex port implementation.
Out: any change to the default installation or the release gate; remote semantic deployment (separate issue).

Design notes

• Dependencies (@huggingface/transformers → onnxruntime-node) stay outside the core graph (§8.9); the base CLI must never import them until explicitly enabled.
• Transformers.js exposes download progress and local-files-only controls (ref [17]), which is what makes the §5.6 download contract implementable.
• The complete EmbeddingProfile (§10.7) is recorded in the manifest, model ID, immutable revision, tokenizer, pooling, normalization, value type, dimensions, because matching dimensions alone is not compatibility (§24.12).

Acceptance criteria

• The base CLI never imports semantic dependencies until the enhancement is explicitly installed (asserted by the arch-rules test).
• lore enhance semantic shows the exact package, model, revision, dimensions, download size, and cache path before any mutation (§5.6).
• Downloads report byte progress, write to a partial file, and resume when the provider supports byte-range requests.
• Expected size and checksum verified before activation; corrupt partial downloads are removed or quarantined.
• --offline uses only a verified local cache and fails clearly when it is insufficient.
• Installation or load failure leaves the current lexical build fully usable, with the capability difference shown (§6.9).
• A semantic-enabled build records the complete EmbeddingProfile in its manifest and adds semantic-search to capabilities.
• Builds without semantic vectors remain fully valid (§13.8).

Tests / verification

• Download-flow tests with simulated interruption, resume, checksum mismatch, and offline mode.
• Isolation test asserting a default install pulls no ONNX/transformers dependency.
• Manifest tests for EmbeddingProfile completeness.
• Degradation test: semantic unavailable → lexical results plus a capability notice.

Dependencies

Blocked by the v0.1 release (#102).

Definition of Done

Semantic support can be added by a user who wants it, without ever touching the zero-dependency first-run promise.